Earlier quoted context omitted.
Already there - whatsapp, instagram oops...
Hacker news....
Oh, look at them rush to White Knight their own bubble. "Not OUR echo chamber, no! We're different, you see, because reasons."
Getting any Facebook user's friend list and partial payment card details
71–80 of 95 posts
Re: Getting any Facebook user's friend list and partial payment card details
#72I wonder what the `CSPlaygroundGraphQLFriendsQuery` query is meant for. It sounds like some testing/development thing.
`CS` in this context stands for ComponentScript. It appears to have something to do with React Native.
`CSPlaygroundGraphQLFriendsQuery` is a demonstration for Facebook engineers internally to show how to display a list of "oneself's friends with auto-pagination" using GraphQL and ComponentScript inside their Facebook main app
P.S. I don't work at Facebook. But this is something I stumbled across their app.
Re: Getting any Facebook user's friend list and partial payment card details
#73Earlier quoted context omitted.
Hacker news....
This effect is partially muted by the fact that one can only see the vote status of one’s own post. There is still a tendency toward conformity, but at least the suggestion to vote with other readers isn’t apparent like it is on many content aggregators/discussion media.
Except downvoted posts here turn gray.
Re: Getting any Facebook user's friend list and partial payment card details
#74I wonder what the `CSPlaygroundGraphQLFriendsQuery` query is meant for. It sounds like some testing/development thing.
`CS` in this context stands for ComponentScript. It appears to have something to do with React Native. `CSPlaygroundGraphQLFriendsQuery` is a demonstration for Facebook engineers internally to show how to display a list of "oneself's friends with auto-pagination" using GraphQL and ComponentScript inside their Facebook main app P.S. I don't work at Facebook. But this is something I stumbled across their app.
Like the demo was released and accessible in the app? Or did you see it in the RN JS code?
Re: Getting any Facebook user's friend list and partial payment card details
#75Earlier quoted context omitted.
First six and last four are the limits for display set out by the PCI Security Standards Council. The things you should never store with the PAN are the PIN/PIN block or CVC/CVV. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...
How does that work? If you can't store the CVC/CVV, how come I don't have to re-enter it when I re-order form say Amazon or Foodora? Or maybe I do have to enter it? Don't remember :|
Amazon, specifically, never asks for CVC/CVV in the first place.
It is not required for charging a card, it is for reducing fraud.
Re: Getting any Facebook user's friend list and partial payment card details
#76Earlier quoted context omitted.
`CS` in this context stands for ComponentScript. It appears to have something to do with React Native. `CSPlaygroundGraphQLFriendsQuery` is a demonstration for Facebook engineers internally to show how to display a list of "oneself's friends with auto-pagination" using GraphQL and ComponentScript inside their Facebook main app P.S. I don't work at Facebook. But this is something I stumbled across their app.
Like the demo was released and accessible in the app? Or did you see it in the RN JS code?
The demo is included as part of their main app (even in production) (at least in Facebook for Android), and was supposedly only accessible by Facebook engineers.
Re: Getting any Facebook user's friend list and partial payment card details
#77Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."
There's an important unstated property too, btw. OP reported an information disclosure bug in payment handling code. A bug in the core logic of what literally brings money in.
That kind of bug report is bound to get a very quick triage, followed by a very quick escalation.
But yes, even with that in mind: a 4-hour turnaround is damn impressive.
Re: Getting any Facebook user's friend list and partial payment card details
#78Re: Getting any Facebook user's friend list and partial payment card details
#79Earlier quoted context omitted.
That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
Random question I've never found a place to ask before. Is there a formal language or method for specifying information like this, where I could map out different pieces of data and reason about how the pieces of data flow through a system, to prove mathematically that two (or n) pieces of data are never available in the same place?
You might model software data and operations in some formal system at various levels using a language like "coq" and develop some formal verification proofs. I've not read this book that apparently explores verifications like these: "Certified Programming with Dependent Types: ...".
I'm not sure what types of enterprises actually use formal verification since it's very costly. Writing software is much faster than verifying it. Embedded auto, aerospace, industrial applications, sure. Facebook? I doubt it.
Such methods could be useful, maybe coupled with fuzzing, for breaking software too. It might suggest avenues for exploit.
Systems like coq are used more naturally in math proofs, but even there it's very hard to apply.
Re: Getting any Facebook user's friend list and partial payment card details
#80Earlier quoted context omitted.
If it took much longer than that for bugs like this, all of the HN doomsday posts about the Facebook mass exodus might actually come true
I think people leaving facebook en masse would be a good thing (TM) for society, not a doomsday. Fewer echo chambers, less disinformation, and people forced to make effort to contact each other.
Some crtical thinking would be good for a society. Tools are just tools.